{"id":5404,"date":"2026-09-12T09:00:00","date_gmt":"2026-09-12T09:00:00","guid":{"rendered":"https:\/\/yamuparkoti.com\/?p=5404"},"modified":"2026-08-21T19:38:26","modified_gmt":"2026-08-21T19:38:26","slug":"ransomware-chusho-kigyo-data","status":"publish","type":"post","link":"https:\/\/yamuparkoti.com\/ja\/ransomware-small-business-data\/","title":{"rendered":"Ransomware and Small Business: The Real Numbers"},"content":{"rendered":"

You have almost certainly read that 60% of small businesses close within six months of a cyberattack<\/strong>.<\/p>\n

It appears everywhere. News outlets, vendor pages, government talks, conference slides.<\/p>\n

There is one problem with it.<\/p>\n

It is not true, and the organisation usually credited with it has publicly said so.<\/strong><\/p>\n

The National Cybersecurity Alliance issued a statement confirming the figure did not come from their research and that they cannot verify its source (National Cybersecurity Alliance, 2026).<\/p>\n

So let us look at what the real numbers say instead. \ud83d\udee1\ufe0f<\/p>\n

\ud83c\udf81 Compare Backup and Security Trials \u2192<\/a><\/p>\n

\ud83e\uddfe\u4e3b\u306a\u8abf\u67fb\u7d50\u679c\u306e\u6982\u8981<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n
\u6e2c\u5b9a<\/th>\n\u5f62<\/th>\n\u30bd\u30fc\u30b9<\/th>\n<\/tr>\n<\/thead>\n
The famous “60% close” figure<\/td>\nUnverified, disavowed<\/strong><\/td>\nNational Cybersecurity Alliance (2026)<\/td>\n<\/tr>\n
SMBs going out of business after an attack<\/td>\nAbout 19%<\/strong><\/td>\nMastercard survey, cited 2026<\/td>\n<\/tr>\n
Cyberattacks aimed at SMBs<\/td>\nAbout 43%<\/td>\nAstra (2026)<\/td>\n<\/tr>\n
Ransomware present in SMB breaches<\/td>\n88%<\/strong><\/td>\nVerizon DBIR (2025)<\/td>\n<\/tr>\n
Same figure at large organisations<\/td>\n39%<\/td>\nVerizon DBIR (2025)<\/td>\n<\/tr>\n
Average ransomware downtime<\/td>\nAbout 24 days<\/td>\nHuntress (2026)<\/td>\n<\/tr>\n
Recovery cost, excluding ransom<\/td>\n$1.53 million average<\/strong><\/td>\nHuntress (2026)<\/td>\n<\/tr>\n
Typical small business range<\/td>\n$120,000 to $1.24 million<\/td>\nSQ Magazine (2026)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\"Ransomware<\/p>\n

\ud83e\udddf The Statistic That Refuses to Die<\/h2>\n

This deserves proper attention, because it shapes how people think about the whole topic.<\/p>\n

The 60% claim first appeared around 2011.<\/p>\n

It has been repeated for roughly fifteen years without anyone producing the underlying study.<\/p>\n

What the NCSA actually said<\/h3>\n

The National Cybersecurity Alliance is the body most often credited with the figure.<\/p>\n

They published a statement noting the statistic was not generated from their research.<\/p>\n

They also confirmed they cannot verify its original source.<\/strong><\/p>\n

They stopped using it in their own materials.<\/p>\n

Why it spread so effectively<\/h3>\n

It is memorable, alarming and useful to anyone selling security products.<\/p>\n

Each retelling cited the previous one rather than any primary source.<\/p>\n

After enough repetitions, it looked like established fact.<\/p>\n

\n

\ud83d\udcca The myth against the measured figure<\/p>\n

\n\n\n60%<\/text>\nWidely repeated claim<\/text>\nunverified<\/text>\n\n19%<\/text>\nMeasured in survey<\/text>\n5,000+ owners<\/text>\nSources: National Cybersecurity Alliance (2026) disavowal; Mastercard survey, cited 2026.<\/text>\n<\/svg>\n<\/div>\n

What the real number appears to be<\/h3>\n

A Mastercard survey covered more than 5,000 small business owners. Almost one in five who suffered an attack went out of business.<\/p>\n

That is roughly 19%, not 60%.<\/p>\n

Still serious. Still a fifth of affected businesses. But a third of the claim.<\/strong><\/p>\n

Why the correction matters<\/h3>\n

Inflated statistics do not make people safer.<\/p>\n

They make the problem feel unsurvivable, which encourages fatalism rather than action.<\/p>\n

And when someone discovers one figure was invented, they discount the accurate ones too.<\/p>\n

\ud83d\udd0e Try Backup Tools Free \u2192<\/a><\/p>\n

\ud83c\udfaf Why Small Businesses Are Targeted<\/h2>\n

The genuine finding here is stark, and better evidenced than the myth.<\/p>\n

Ransomware was present in 88% of breaches at small and mid-sized businesses<\/strong> (Verizon, 2025).<\/p>\n

At large organisations the figure was 39%.<\/p>\n

More than double the rate.<\/p>\n

\n

\ud83d\udcca Ransomware present in breaches, by organisation size<\/p>\n

\n\n\n88%<\/text>\nSmall and mid-sized<\/text>\n\n39%<\/text>\nLarge organisations<\/text>\nSource: Verizon Data Breach Investigations Report (2025).<\/text>\n<\/svg>\n<\/div>\n

Why the gap exists<\/h3>\n

Large organisations have security teams, tested backups and incident plans.<\/p>\n

They still get attacked, but ransomware succeeds less often.<\/p>\n

Small businesses are not attacked more because they are chosen. They are attacked more because attacks succeed.<\/strong><\/p>\n

The automation point<\/h3>\n

Most ransomware is not targeted at a specific company.<\/p>\n

Automated tools scan for known weaknesses across the whole internet.<\/p>\n

Being small does not make you invisible. It often makes you easier.<\/p>\n

\u23f1\ufe0f What an Attack Actually Costs<\/h2>\n

The financial figures are wide, and the reason is worth knowing.<\/p>\n\n\n\n\n\n\n\n\n\n
Cost element<\/th>\nTypical scale<\/th>\n<\/tr>\n<\/thead>\n
Downtime<\/td>\nAround 24 days on average<\/strong><\/td>\n<\/tr>\n
Recovery excluding ransom<\/td>\n$1.53 million average<\/td>\n<\/tr>\n
Small business range<\/td>\n$120,000 to $1.24 million<\/strong><\/td>\n<\/tr>\n
Ransom itself<\/td>\nHighly variable, often not the largest cost<\/td>\n<\/tr>\n
Lost customers<\/td>\nRuns long after recovery<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Note that the ransom is rarely the biggest line.<\/p>\n

Twenty-four days of downtime destroys more value than most ransom demands.<\/strong><\/p>\n

Why downtime dominates<\/h3>\n

A business that cannot invoice, deliver or answer customers for three weeks is in serious trouble.<\/p>\n

Staff still get paid. Rent still falls due.<\/p>\n

Revenue stops while costs continue, and that gap is what closes companies.<\/p>\n

The range tells you something<\/h3>\n

$120,000 to $1.24 million is an enormous spread.<\/p>\n

The difference is almost entirely preparation.<\/p>\n

Businesses with tested backups recover in days. Those without recover in weeks or never.<\/p>\n

\ud83d\udcca Where the Money Actually Goes<\/h2>\n

Splitting the cost shows why preparation changes the outcome so much.<\/p>\n

\n

\ud83e\udd67 Typical ransomware cost breakdown<\/p>\n

\n\n\n\n\ntotal cost<\/text>\nDowntime and lost revenue<\/text>\nRecovery and IT work<\/text>\nLegal, notification, advice<\/text>\nRansom, where paid<\/text>\nIndicative split. Downtime dominates (Huntress, 2026).<\/text>\n<\/svg>\n<\/div>\n

Notice how small the ransom slice is.<\/p>\n

Most of the damage happens while the business cannot operate.<\/strong><\/p>\n

Why that changes what to spend on<\/h3>\n

If downtime is the main cost, the main defence is fast recovery.<\/p>\n

That means tested backups, not just more prevention tools.<\/p>\n

A business that restores in two days avoids most of the loss (SQ Magazine, 2026).<\/p>\n

The sectors that suffer longest<\/h3>\n

Recovery times vary widely by industry.<\/p>\n

Manufacturing tends to be slowest, because physical processes stop.<\/p>\n

Financial firms recover fastest, largely because they rehearse it (Huntress, 2026).<\/p>\n

\ud83d\udcbe Why Backups Are the Whole Game<\/h2>\n

Ransomware works by making your data unavailable.<\/p>\n

A working backup makes that threat far weaker.<\/p>\n

But most backup setups fail at the moment they are needed.<\/p>\n\n\n\n\n\n\n\n\n\n
Common failure<\/th>\nWhy it happens<\/th>\n<\/tr>\n<\/thead>\n
Backup was never tested<\/td>\nNobody tried restoring<\/strong><\/td>\n<\/tr>\n
Backup drive was connected<\/td>\nEncrypted along with everything else<\/td>\n<\/tr>\n
Backup stopped months ago<\/td>\nFailure alerts ignored<\/td>\n<\/tr>\n
Only some data covered<\/td>\nNobody audited what was included<\/td>\n<\/tr>\n
Restore takes too long<\/td>\nTechnically works, practically useless<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The second row catches many businesses.<\/p>\n

A backup drive left plugged in gets encrypted with the rest.<\/strong><\/p>\n

The rule that works<\/h3>\n

Keep at least one backup copy disconnected or immutable.<\/p>\n

Cloud backups with versioning handle this well, since older versions survive.<\/p>\n

The principle is simple: ransomware should not be able to reach every copy.<\/p>\n

Test the restore, not the backup<\/h3>\n

This is the step nearly everyone skips.<\/p>\n

A backup that runs successfully is not proof you can recover.<\/p>\n

Restore a few real files, quarterly. It takes fifteen minutes.<\/p>\n

Keep one backup off the domain<\/h3>\n

Attackers who gain administrator access often target backup systems first.<\/p>\n

A backup managed by the same credentials as everything else can be deleted with everything else.<\/p>\n

At least one copy should be outside that control, with separate credentials.<\/strong><\/p>\n

Know your restore time<\/h3>\n

Ask how long a full restore would actually take.<\/p>\n

If the answer is a week, that is a week of downtime you have already accepted.<\/p>\n

\u79c1\u305f\u3061\u306e breach cost analysis<\/a> covers why time dominates every cost calculation.<\/p>\n

\ud83d\udeaa How Ransomware Gets In<\/h2>\n

The entry routes are unglamorous and mostly preventable.<\/p>\n\n\n\n\n\n\n\n\n\n
\u30eb\u30fc\u30c8<\/th>\n\u9632\u6b62<\/th>\n<\/tr>\n<\/thead>\n
Stolen or reused credentials<\/td>\nMulti-factor sign-in<\/strong><\/td>\n<\/tr>\n
Phishing email<\/td>\nStaff awareness, email filtering<\/td>\n<\/tr>\n
Unpatched software<\/td>\nAutomatic updates<\/td>\n<\/tr>\n
Exposed remote access<\/td>\nClose it or put it behind MFA<\/strong><\/td>\n<\/tr>\n
Compromised supplier<\/td>\nHarder \u2014 ask about their security<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Four of five are addressable without much budget.<\/p>\n

\u79c1\u305f\u3061\u306e password research<\/a> shows MFA cut account compromise by over 99%.<\/p>\n

Remote access is the quiet one<\/h3>\n

Many small businesses expose remote desktop access to the internet.<\/p>\n

It is convenient, and automated scanners find it within hours.<\/p>\n

If you need remote access, it should sit behind MFA at minimum.<\/p>\n

Updates matter more than antivirus<\/h3>\n

Most successful attacks use weaknesses that were already patched.<\/p>\n

The patch existed. Nobody applied it.<\/p>\n

Automatic updates are free and prevent more than most paid products.<\/strong><\/p>\n

\ud83d\udcb8 The Ransom Question<\/h2>\n

If it happens, should you pay? The honest answer is layered.<\/p>\n

Law enforcement generally advises against it.<\/p>\n

Payment funds further attacks and marks you as willing to pay.<\/p>\n

What payment does not buy<\/h3>\n

It buys a decryption tool, from a criminal, with no guarantee.<\/p>\n

Recovery after payment is often partial and slow.<\/p>\n

And modern attacks steal data before encrypting, so payment does not prevent publication.<\/p>\n

Why that last point changed everything<\/h3>\n

Ransomware used to be about locking files.<\/p>\n

Now a large share of attacks also threaten to publish stolen data.<\/p>\n

Backups solve the encryption problem but not the publication problem.<\/strong><\/p>\n

\u5b9f\u969b\u7684\u306a\u610f\u5473<\/h3>\n

\u4e88\u9632\u306e\u91cd\u8981\u6027\u306f\u4ee5\u524d\u3088\u308a\u3082\u9ad8\u307e\u3063\u3066\u3044\u308b\u3002\u306a\u305c\u306a\u3089\u3001\u56de\u5fa9\u306b\u3088\u308b\u52b9\u679c\u306f\u4ee5\u524d\u307b\u3069\u5927\u304d\u304f\u306a\u3044\u304b\u3089\u3060\u3002<\/p>\n

A perfect backup no longer makes you immune, only resilient.<\/p>\n

\ud83e\uddfe Which Small Businesses Get Hit Hardest<\/h2>\n

Exposure is not evenly spread, and the pattern is predictable.<\/p>\n\n\n\n\n\n\n\n\n\n\n
\u8981\u7d20<\/th>\nRaises risk?<\/th>\n\u306a\u305c<\/th>\n<\/tr>\n<\/thead>\n
Holding customer payment data<\/td>\n\u306f\u3044<\/strong><\/td>\nHigher value to attackers<\/td>\n<\/tr>\n
Remote access exposed online<\/td>\n\u306f\u3044<\/td>\nFound by automated scanners<\/td>\n<\/tr>\n
Older unsupported software<\/td>\nYes, strongly<\/strong><\/td>\nKnown weaknesses never patched<\/td>\n<\/tr>\n
Supplier to larger firms<\/td>\n\u306f\u3044<\/td>\nA route into bigger targets<\/td>\n<\/tr>\n
No dedicated IT support<\/td>\n\u306f\u3044<\/td>\nNobody watching for signs<\/td>\n<\/tr>\n
Regulated sector<\/td>\nCost, not likelihood<\/td>\nFines and notification duties<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The supplier row deserves attention, because it surprises people.<\/p>\n

A small firm can be attacked as a route into its largest customer.<\/strong><\/p>\n

That is why big companies increasingly ask suppliers about their security.<\/p>\n

The unsupported software problem<\/h3>\n

Software past end of life stops receiving fixes entirely.<\/p>\n

Every weakness found after that date stays open permanently.<\/p>\n

Automated scanners specifically look for these versions (Astra, 2026).<\/p>\n

Being a supplier changes your obligations<\/h3>\n

Larger customers may require evidence of controls before renewing contracts.<\/p>\n

That turns security from a cost into a condition of trading.<\/p>\n

Many small firms first take it seriously when a customer asks.<\/p>\n

\ud83d\udccb What a Small Business Should Actually Do<\/h2>\n

Ranked by protection per pound spent.<\/p>\n\n\n\n\n\n\n\n\n\n\n
\u30a2\u30af\u30b7\u30e7\u30f3<\/th>\n\u6599\u91d1<\/th>\nEffect<\/th>\n<\/tr>\n<\/thead>\n
MFA on email and remote access<\/td>\n\u7121\u6599<\/strong><\/td>\nBlocks the most common entry<\/td>\n<\/tr>\n
Automatic updates everywhere<\/td>\n\u7121\u6599<\/td>\nCloses known weaknesses<\/td>\n<\/tr>\n
One offline or immutable backup<\/td>\n\u4f4e\u3044<\/td>\nSurvives encryption<\/strong><\/td>\n<\/tr>\n
Quarterly restore test<\/td>\n15\u5206<\/td>\nProves the backup works<\/td>\n<\/tr>\n
Close unused remote access<\/td>\n\u7121\u6599<\/td>\nRemoves a scanned target<\/td>\n<\/tr>\n
1\u30da\u30fc\u30b8\u5b8c\u7d50\u578b\u306e\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u5bfe\u5fdc\u8a08\u753b<\/td>\nAn hour<\/td>\nSaves days of confusion<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Four of six cost nothing at all.<\/p>\n

The gap between prepared and unprepared businesses is mostly attention, not budget.<\/strong><\/p>\n

\u8ab0\u3082\u66f8\u304b\u306a\u3044\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u8a08\u753b<\/h3>\n

Three questions on one page. Who decides? Who calls the insurer or lawyer? Who tells customers?<\/p>\n

Deciding that during an incident costs days.<\/p>\n

Deciding it in advance costs an hour.<\/p>\n

Train staff on one thing, not everything<\/h3>\n

Security awareness training often tries to cover too much and lands nowhere.<\/p>\n

Pick the single behaviour that matters most: report anything suspicious immediately, without blame.<\/p>\n

Most incidents are noticed by an ordinary employee before any system flags them.<\/strong><\/p>\n

If people fear being blamed, they stay quiet, and hours are lost.<\/p>\n

Cyber insurance, briefly<\/h3>\n

Policies increasingly require MFA and tested backups before paying out.<\/p>\n

Read those conditions before assuming you are covered.<\/p>\n

An insurer can decline if the required controls were not in place.<\/p>\n

\ud83d\udea8 The First Hour, If It Happens<\/h2>\n

Most damage in the early stage comes from panic rather than the attack itself.<\/p>\n

Knowing the sequence in advance is worth more than any single tool.<\/p>\n\n\n\n\n\n\n\n\n\n\n
Order<\/th>\n\u30a2\u30af\u30b7\u30e7\u30f3<\/th>\n\u306a\u305c<\/th>\n<\/tr>\n<\/thead>\n
1<\/td>\nDisconnect affected machines from the network<\/strong><\/td>\nStops spread<\/td>\n<\/tr>\n
2<\/td>\nDo not power them off<\/td>\nPreserves evidence in memory<\/td>\n<\/tr>\n
3<\/td>\nCheck whether backups are reachable<\/td>\nDetermines your options<\/td>\n<\/tr>\n
4<\/td>\nNotify insurer and legal contact<\/td>\nPolicies often require early notice<\/strong><\/td>\n<\/tr>\n
5<\/td>\nStart a written timeline<\/td>\nRegulators will ask<\/td>\n<\/tr>\n
6<\/td>\nDecide who speaks to customers<\/td>\nPrevents mixed messages<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Row two is counterintuitive and frequently got wrong.<\/p>\n

Powering a machine off destroys evidence that helps investigators understand what happened.<\/strong><\/p>\n

Why the insurer comes early<\/h3>\n

Many policies require notification within a short window.<\/p>\n

Some also require you to use their approved responders.<\/p>\n

Calling your own specialist first can jeopardise the claim.<\/p>\n

The notification clock<\/h3>\n

If personal data was involved, regulators often require reporting within 72 hours of discovery.<\/p>\n

That clock starts when you find out, not when you finish investigating.<\/p>\n

\u79c1\u305f\u3061\u306e breach cost analysis<\/a> covers how that timing drives cost.<\/p>\n

Write it down as you go<\/h3>\n

Memory degrades fast during an incident.<\/p>\n

A simple timestamped log answers most later questions from insurers and regulators.<\/p>\n

It costs nothing and is almost never done.<\/p>\n

\ud83d\udd2c How Reliable Is This Data?<\/h2>\n\n\n\n\n\n\n\n\n
\u30bd\u30fc\u30b9<\/th>\n\u5f37\u3055<\/th>\nCaveat<\/th>\n<\/tr>\n<\/thead>\n
Verizon DBIR<\/td>\nLong-running, consistent method<\/strong><\/td>\nReported incidents only<\/td>\n<\/tr>\n
Mastercard SMB survey<\/td>\n5,000+ owners<\/td>\nSelf-reported<\/td>\n<\/tr>\n
Security vendor statistics<\/td>\nPractical detail<\/td>\nThey sell the solution<\/strong><\/td>\n<\/tr>\n
The 60% closure claim<\/td>\n\u306a\u3057<\/td>\nDisavowed by NCSA<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

That bottom row is the lesson of this article.<\/p>\n

How to check a scary statistic<\/h3>\n

Trace it back until you reach an organisation that collected data.<\/p>\n

If every citation points to another article, you have found a rumour.<\/p>\n

A statistic with no primary source is not a statistic.<\/strong><\/p>\n

Why undercounting is likely too<\/h3>\n

Many small businesses never report attacks.<\/p>\n

They pay quietly, or recover without telling anyone.<\/p>\n

So real attack rates are probably higher than reported figures, even as closure rates are lower than claimed.<\/p>\n

\ud83e\uddef Why “We Are Too Small to Target” Is Wrong<\/h2>\n

This belief is the single most common reason small businesses do nothing.<\/p>\n

\u305d\u308c\u306f\u3001\u653b\u6483\u304c\u5b9f\u969b\u306b\u3069\u306e\u3088\u3046\u306b\u6a5f\u80fd\u3059\u308b\u304b\u306b\u3064\u3044\u3066\u306e\u8aa4\u89e3\u306b\u57fa\u3065\u3044\u3066\u3044\u307e\u3059\u3002<\/p>\n

\u8ab0\u3082\u3042\u306a\u305f\u3092\u9078\u3070\u306a\u304b\u3063\u305f<\/h3>\n

\u307b\u3068\u3093\u3069\u306e\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u306f\u3001\u9078\u629e\u3067\u306f\u306a\u304f\u81ea\u52d5\u30b9\u30ad\u30e3\u30f3\u306b\u3088\u3063\u3066\u5230\u7740\u3057\u307e\u3059\u3002<\/p>\n

\u30c4\u30fc\u30eb\u306f\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u3092\u5e2d\u5dfb\u3057\u3001\u516c\u958b\u3055\u308c\u305f\u30b5\u30fc\u30d3\u30b9\u3084\u65e2\u77e5\u306e\u5f31\u70b9\u3092\u63a2\u3057\u307e\u3059\u3002<\/p>\n

\u653b\u6483\u8005\u306f\u3001\u4fb5\u5165\u3057\u3066\u521d\u3081\u3066\u3042\u306a\u305f\u304c\u4f55\u8005\u3067\u3042\u308b\u304b\u3092\u77e5\u308b\u3053\u3068\u304c\u3088\u304f\u3042\u308a\u307e\u3059\u3002<\/strong><\/p>\n

\u5c0f\u3055\u3044\u304b\u3089\u3068\u3044\u3063\u3066\u653b\u6483\u304c\u5b89\u304f\u306a\u308b\u308f\u3051\u3067\u306f\u306a\u3044<\/h3>\n

\u81ea\u52d5\u5316\u306b\u3088\u308a\u3001\u8a66\u3059\u30b3\u30b9\u30c8\u304c\u306a\u304f\u306a\u308a\u307e\u3057\u305f\u3002<\/p>\n

100 \u4e07\u4ef6\u306e\u30a2\u30c9\u30ec\u30b9\u3092\u30b9\u30ad\u30e3\u30f3\u3059\u308b\u5834\u5408\u306e\u30b3\u30b9\u30c8\u306f\u3001100 \u4ef6\u306e\u30a2\u30c9\u30ec\u30b9\u3092\u30b9\u30ad\u30e3\u30f3\u3059\u308b\u306e\u3068\u307b\u3068\u3093\u3069\u5909\u308f\u308a\u307e\u305b\u3093\u3002<\/p>\n

\u3057\u305f\u304c\u3063\u3066\u3001\u5c0f\u3055\u306a\u76ee\u6a19\u3092\u30b9\u30ad\u30c3\u30d7\u3059\u308b\u7d4c\u6e08\u7684\u306a\u7406\u7531\u306f\u3042\u308a\u307e\u305b\u3093\u3002<\/p>\n

\u81ea\u52d5\u5316\u3055\u308c\u305f\u653b\u6483\u3092\u5b9f\u969b\u306b\u963b\u6b62\u3059\u308b\u3082\u306e<\/h3>\n

\u66d6\u6627\u3055\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u3002\u30ea\u30b9\u30c8\u306e\u6b21\u306e\u7d50\u679c\u3088\u308a\u3082\u96e3\u3057\u3044\u3068\u3044\u3046\u3060\u3051\u3067\u3059\u3002<\/p>\n

\u901a\u5e38\u306f\u3001\u30d1\u30c3\u30c1\u3092\u9069\u7528\u3057\u305f\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u3001MFA\u3001\u304a\u3088\u3073\u516c\u958b\u3055\u308c\u305f\u30ea\u30e2\u30fc\u30c8 \u30a2\u30af\u30bb\u30b9\u304c\u306a\u3044\u3060\u3051\u3067\u5341\u5206\u3067\u3059\u3002<\/p>\n

\u3053\u308c\u3089\u306e\u653b\u6483\u306f\u3001\u6700\u3082\u4fa1\u5024\u306e\u3042\u308b\u30bf\u30fc\u30b2\u30c3\u30c8\u3067\u306f\u306a\u304f\u3001\u6700\u3082\u7c21\u5358\u306b\u5165\u624b\u53ef\u80fd\u306a\u30bf\u30fc\u30b2\u30c3\u30c8\u3092\u8ffd\u6c42\u3057\u307e\u3059\u3002<\/p>\n

\u6587\u8108\u4e0a\u306e 43% \u3068\u3044\u3046\u6570\u5b57<\/h3>\n

\u30b5\u30a4\u30d0\u30fc\u653b\u6483\u306e\u7d04 43% \u306f\u4e2d\u5c0f\u4f01\u696d\u3092\u72d9\u3063\u3066\u3044\u307e\u3059 (Astra\u30012026)\u3002<\/p>\n

\u3053\u308c\u306f\u3001\u6700\u3082\u6e96\u5099\u304c\u6574\u3063\u3066\u3044\u306a\u3044\u30bb\u30b0\u30e1\u30f3\u30c8\u3092\u653b\u6483\u3059\u308b\u3059\u3079\u3066\u306e\u653b\u6483\u306e\u534a\u5206\u8fd1\u304f\u306b\u76f8\u5f53\u3057\u307e\u3059\u3002<\/p>\n

\u5c11\u306a\u304f\u3068\u308210\u5e74\u9593\u3001\u7121\u540d\u3055\u306f\u8ab0\u3082\u5b88\u3063\u3066\u304d\u307e\u305b\u3093\u3067\u3057\u305f\u3002<\/p>\n

\ud83d\udeab \u3053\u306e\u30c7\u30fc\u30bf\u3067\u306f\u308f\u304b\u3089\u306a\u3044\u3053\u3068<\/h2>\n

\u3042\u306a\u305f\u306e\u30ea\u30b9\u30af\u3092\u4e88\u6e2c\u3059\u308b\u3082\u306e\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u3002<\/strong> \u30bb\u30af\u30bf\u30fc\u3068\u30a8\u30af\u30b9\u30dd\u30fc\u30b8\u30e3\u30fc\u306f\u5927\u304d\u304f\u7570\u306a\u308a\u307e\u3059\u3002<\/p>\n

\u8abf\u67fb\u30c7\u30fc\u30bf\u306f\u81ea\u5df1\u7533\u544a\u3067\u3059\u3002<\/strong> \u98fc\u3044\u4e3b\u304c\u539f\u56e0\u3092\u9593\u9055\u3063\u3066\u899a\u3048\u3066\u3044\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n

\u5831\u544a\u3055\u308c\u3066\u3044\u306a\u3044\u653b\u6483\u306f\u76ee\u306b\u898b\u3048\u307e\u305b\u3093\u3002<\/strong> \u672c\u5f53\u306e\u5272\u5408\u306f\u304a\u305d\u3089\u304f\u3082\u3063\u3068\u9ad8\u3044\u3067\u3057\u3087\u3046\u3002<\/p>\n

\u30b3\u30b9\u30c8\u306e\u7bc4\u56f2\u306f\u975e\u5e38\u306b\u5e83\u3044\u3067\u3059\u3002<\/strong> \u9055\u3044\u306e\u307b\u3068\u3093\u3069\u306f\u6e96\u5099\u306b\u3088\u3063\u3066\u6c7a\u307e\u308a\u307e\u3059\u3002<\/p>\n

\u591a\u304f\u306e\u7814\u7a76\u306f\u30d9\u30f3\u30c0\u30fc\u306b\u3088\u3063\u3066\u516c\u958b\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/strong> \u6050\u6016\u304c\u58f2\u4e0a\u3092\u652f\u3048\u307e\u3059\u3002<\/p>\n

\ud83c\udfc1 \u77ed\u7e2e\u7248<\/h2>\n

\u4e2d\u5c0f\u4f01\u696d\u306e 60% \u304c\u653b\u6483\u5f8c\u306b\u9589\u5e97\u3059\u308b\u3068\u3044\u3046\u6709\u540d\u306a\u4e3b\u5f35\u306b\u306f\u691c\u8a3c\u53ef\u80fd\u306a\u60c5\u5831\u6e90\u304c\u3042\u308a\u307e\u305b\u3093\u3002\u3053\u308c\u306b\u95a2\u4e0e\u3057\u305f\u3068\u3055\u308c\u308b\u7d44\u7e54\u306f\u305d\u3046\u8ff0\u3079\u3066\u3044\u307e\u3059 (National Cyber\u200b\u200bsecurity Alliance\u30012026)\u3002<\/p>\n

5,000 \u4eba\u4ee5\u4e0a\u306e\u6240\u6709\u8005\u3092\u5bfe\u8c61\u3068\u3057\u305f\u8abf\u67fb\u304b\u3089\u5f97\u3089\u308c\u305f\u5b9f\u6e2c\u5024\u306f 19% \u306b\u8fd1\u3044\u3082\u306e\u3067\u3059\u3002<\/p>\n

\u672c\u7269\u306e\u8abf\u67fb\u7d50\u679c\u306f\u3001\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u304c\u4e2d\u5c0f\u4f01\u696d\u306e\u4fb5\u5bb3\u306e 88% \u3067\u767a\u751f\u3057\u3066\u3044\u308b\u306e\u306b\u5bfe\u3057\u3001\u5927\u898f\u6a21\u7d44\u7e54\u3067\u306f 39% \u3067\u3042\u308b\u3068\u3044\u3046\u3053\u3068\u3067\u3059\u3002<\/strong> (Verizon, 2025).<\/p>\n

\u4e2d\u5c0f\u4f01\u696d\u306f\u3053\u308c\u4ee5\u4e0a\u6a19\u7684\u306b\u3055\u308c\u307e\u305b\u3093\u3002\u5f7c\u3089\u306b\u5bfe\u3059\u308b\u653b\u6483\u306f\u3088\u308a\u6210\u529f\u3057\u307e\u3059\u3002<\/p>\n

\u5e73\u5747\u7684\u306a\u30c0\u30a6\u30f3\u30bf\u30a4\u30e0\u306f\u7d04 24 \u65e5\u9593\u3067\u3001\u30c0\u30a6\u30f3\u30bf\u30a4\u30e0\u306b\u304b\u304b\u308b\u8cbb\u7528\u306f\u307b\u3068\u3093\u3069\u306e\u8eab\u4ee3\u91d1\u3088\u308a\u3082\u9ad8\u304f\u306a\u308a\u307e\u3059\u3002<\/p>\n

6 \u3064\u306e\u6700\u3082\u52b9\u679c\u7684\u306a\u4fdd\u8b77\u6a5f\u80fd\u306e\u3046\u3061 4 \u3064 (MFA\u3001\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3001\u30ea\u30e2\u30fc\u30c8 \u30a2\u30af\u30bb\u30b9\u306e\u9589\u9396\u3001\u66f8\u9762\u306b\u3088\u308b\u8a08\u753b) \u306f\u7121\u6599\u3067\u3059\u3002<\/p>\n

5 \u3064\u76ee\u306f\u3001\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u304c\u5230\u9054\u3067\u304d\u306a\u3044\u30d0\u30c3\u30af\u30a2\u30c3\u30d7 \u30b3\u30d4\u30fc\u3067\u3059\u3002\u5fa9\u5143\u3092\u30c6\u30b9\u30c8\u3057\u307e\u3059\u3002<\/p>\n

\u305d\u3057\u3066\u3001\u3053\u306e\u8a18\u4e8b\u306e\u5192\u982d\u306b\u3042\u308b\u795e\u8a71\u81ea\u4f53\u3092\u6559\u8a13\u3068\u3057\u3066\u6271\u3063\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n

15\u5e74\u9593\u306b\u308f\u305f\u3063\u3066\u7e70\u308a\u8fd4\u3055\u308c\u305f\u6050\u308d\u3057\u3044\u6570\u5b57\u306f\u3001\u4f55\u306e\u7814\u7a76\u3082\u3055\u308c\u3066\u3044\u306a\u3044\u3053\u3068\u304c\u5224\u660e\u3057\u305f\u3002<\/p>\n

\u6182\u616e\u3059\u3079\u304d\u7d71\u8a08\u306b\u57fa\u3065\u3044\u3066\u884c\u52d5\u3059\u308b\u524d\u306b\u3001\u30c7\u30fc\u30bf\u3092\u53ce\u96c6\u3057\u305f\u4eba\u7269\u307e\u3067\u9061\u3063\u3066\u304f\u3060\u3055\u3044\u3002<\/strong><\/p>\n

\u3059\u3079\u3066\u306e\u5f15\u7528\u304c\u5225\u306e\u8a18\u4e8b\u3092\u6307\u3057\u3066\u3044\u308b\u5834\u5408\u306f\u3001\u767a\u898b\u3067\u306f\u306a\u304f\u5642\u3092\u767a\u898b\u3057\u305f\u3053\u3068\u306b\u306a\u308a\u307e\u3059\u3002 \ud83d\udee1\ufe0f<\/p>\n

\ud83d\ude80 \u30d0\u30c3\u30af\u30a2\u30c3\u30d7\u3068\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u30c8\u30e9\u30a4\u30a2\u30eb\u3092\u53c2\u7167 \u2192<\/a><\/p>\n

\u2753 \u3088\u304f\u3042\u308b\u8cea\u554f<\/h2>\n

Do 60% of small businesses really close after a cyberattack?<\/h3>\n

No. The National Cybersecurity Alliance has stated the figure did not come from their research and cannot be verified. Survey data puts it nearer 19%.<\/p>\n

Why is that number everywhere then?<\/h3>\n

It is memorable, alarming and useful to anyone selling security products. Each retelling cited the previous one rather than a study.<\/p>\n

Are small businesses really targeted more?<\/h3>\n

Ransomware appears in 88% of SMB breaches against 39% at large organisations. The difference is that attacks succeed more often, not that attackers choose them.<\/p>\n

How long does recovery take?<\/h3>\n

Average ransomware downtime is around 24 days, though prepared businesses recover far faster.<\/p>\n

What does an attack cost a small business?<\/h3>\n

Typically $120,000 to $1.24 million. Downtime usually costs more than the ransom itself.<\/p>\n

Should we pay the ransom?<\/h3>\n

Law enforcement advises against it. Payment buys a tool from a criminal with no guarantee, and does not stop stolen data being published.<\/p>\n

What is the cheapest effective protection?<\/h3>\n

Multi-factor sign-in on email and remote access. It is free and blocks the most common entry route.<\/p>\n

Why do backups fail when needed?<\/h3>\n

Usually because nobody tested a restore, or the backup drive was connected and got encrypted too.<\/p>\n

Are we too small to be a target?<\/h3>\n

No. Most ransomware arrives through automated scanning rather than selection, and around 43% of attacks hit small and mid-sized businesses (Astra, 2026).<\/p>\n

What should we do in the first hour?<\/h3>\n

Disconnect affected machines from the network but do not power them off, since that destroys evidence. Then check backups and notify your insurer.<\/p>\n

Why does downtime cost more than the ransom?<\/h3>\n

Average downtime runs around 24 days. Revenue stops while wages and rent continue, and that gap is what closes businesses.<\/p>\n

Does being a supplier increase our risk?<\/h3>\n

Yes. Small firms are attacked as a route into larger customers, which is why big companies now ask suppliers about their security.<\/p>\n

Does cyber insurance cover this?<\/h3>\n

Increasingly only if you had MFA and tested backups in place. Read the conditions before assuming cover.<\/p>\n

\ud83d\udcda \u53c2\u8003\u6587\u732e<\/h2>\n

\u56fd\u5bb6\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u540c\u76df\u3002 \uff082026\u5e74\uff09\u3002 \u4e2d\u5c0f\u4f01\u696d\u7d71\u8a08\u306e\u8aa4\u308a\u306b\u95a2\u3059\u308b\u58f0\u660e<\/em>2026\u5e748\u67088\u65e5\u306b\u53d6\u5f97\u3002 https:\/\/www.staysafeonline.org\/press\/national-cyber-security-alliance-statement-regarding-incorrect-small-business-statistic<\/a><\/p>\n

Verizon. (2025). Data breach investigations report<\/em>\u3001Huntres \u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u306e\u7d71\u8a08\u3067\u5f15\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002 2026 \u5e74 8 \u6708 8 \u65e5\u306b\u53d6\u5f97\u3001\u4ee5\u4e0b\u304b\u3089 https:\/\/www.huntress.com\/ransomware-guide\/ransomware-attack-statistics<\/a><\/p>\n

\u30a2\u30b9\u30c8\u30e9\u3002 \uff082026\u5e74\uff09\u3002 \u4e2d\u5c0f\u4f01\u696d\u306e\u30b5\u30a4\u30d0\u30fc\u653b\u6483\u7d71\u8a08<\/em>2026\u5e748\u67088\u65e5\u306b\u53d6\u5f97\u3002 https:\/\/www.getastra.com\/blog\/security-audit\/small-business-cyber-attack-statistics\/<\/a><\/p>\n

SQ\u30de\u30ac\u30b8\u30f3\u3002 \uff082026\u5e74\uff09\u3002 \u4e2d\u5c0f\u4f01\u696d\u306e\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7d71\u8a08: \u8105\u5a01\u3068\u30b3\u30b9\u30c8<\/em>2026\u5e748\u67088\u65e5\u306b\u53d6\u5f97\u3002 https:\/\/sqmagazine.co.uk\/small-business-cybersecurity-statistics\/<\/a><\/p>\n

SC\u30ef\u30fc\u30eb\u30c9\u3002 \uff082026\u5e74\uff09\u3002 \u307b\u3068\u3093\u3069\u306e\u4e2d\u5c0f\u4f01\u696d\u306f\u30c7\u30fc\u30bf\u4fb5\u5bb3\u3092\u751f\u304d\u5ef6\u3073\u307e\u3059<\/em>2026\u5e748\u67088\u65e5\u306b\u53d6\u5f97\u3002 https:\/\/www.scworld.com\/news\/most-small-businesses-survive-data-breaches-heres-how-to-make-sure-yours-does-too<\/a><\/p>\n

\u3053\u306e\u30b5\u30a4\u30c8\u306b\u95a2\u9023\u3059\u308b\u8a18\u4e8b<\/h3>\n

\u79c1\u305f\u3061\u306e \u30d1\u30b9\u30ef\u30fc\u30c9\u3068MFA\u306e\u8abf\u67fb<\/a> \u6700\u3082\u4e00\u822c\u7684\u306a\u4fb5\u5165\u7d4c\u8def\u3092\u8a73\u3057\u304f\u8aac\u660e\u3057\u307e\u3059\u3002\u3053\u3061\u3089\u3082\u3054\u89a7\u304f\u3060\u3055\u3044 breach cost analysis<\/a> \u4e8b\u4ef6\u5f8c\u306e\u3053\u3068\u3001\u305d\u3057\u3066 \u7121\u6599\u30c8\u30e9\u30a4\u30a2\u30eb\u30a4\u30f3\u30b5\u30a4\u30c0\u30fc\u30c7\u30a3\u30ec\u30af\u30c8\u30ea<\/a> \u30d0\u30c3\u30af\u30a2\u30c3\u30d7\u3068\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306e\u30c8\u30e9\u30a4\u30a2\u30eb\u7528\u3002<\/p>\n

\u3053\u306e\u5206\u6790\u306b\u3064\u3044\u3066<\/h3>\n

\u3053\u306e\u8a18\u4e8b\u306f\u3001\u901a\u5e38\u305d\u306e\u8cac\u4efb\u8005\u3068\u3055\u308c\u308b\u7d44\u7e54\u304c\u516c\u8868\u3057\u305f\u5426\u8a8d\u3092\u5229\u7528\u3057\u3066\u3001\u307b\u3068\u3093\u3069\u306e\u7af6\u5408\u3059\u308b\u5831\u9053\u3067\u7e70\u308a\u8fd4\u3055\u308c\u305f\u7d71\u8a08\u3092\u8a02\u6b63\u3057\u307e\u3059\u3002\u6b63\u78ba\u306a\u6570\u5024\u304c\u5b58\u5728\u3059\u308b\u5834\u5408\u306f\u3001\u305d\u306e\u60c5\u5831\u6e90\u3092\u6307\u5b9a\u3057\u3066\u4ee3\u308f\u308a\u306b\u4f7f\u7528\u3055\u308c\u307e\u3059\u3002\u3053\u306e\u30ab\u30c6\u30b4\u30ea\u306e\u7814\u7a76\u306e\u591a\u304f\u306f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30d9\u30f3\u30c0\u30fc\u306b\u3088\u3063\u3066\u516c\u958b\u3055\u308c\u3066\u304a\u308a\u3001\u305d\u3053\u3067\u306f\u6050\u6016\u304c\u8ca9\u58f2\u3092\u652f\u3048\u3066\u304a\u308a\u3001\u305d\u308c\u304c\u96a0\u3055\u308c\u308b\u306e\u3067\u306f\u306a\u304f\u660e\u8a00\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u6570\u5024\u306f2026\u5e748\u67088\u65e5\u306b\u78ba\u8a8d\u3055\u308c\u307e\u3057\u305f\u3002<\/p>","protected":false},"excerpt":{"rendered":"

You have almost certainly read that 60% of small businesses close within six months of a cyberattack. It appears everywhere. […]<\/p>\n","protected":false},"author":1,"featured_media":5403,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_kadence_starter_templates_imported_post":false,"footnotes":""},"categories":[40],"tags":[],"class_list":["post-5404","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ecommerce-reviews"],"_links":{"self":[{"href":"https:\/\/yamuparkoti.com\/ja\/wp-json\/wp\/v2\/posts\/5404","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/yamuparkoti.com\/ja\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/yamuparkoti.com\/ja\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/yamuparkoti.com\/ja\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/yamuparkoti.com\/ja\/wp-json\/wp\/v2\/comments?post=5404"}],"version-history":[{"count":1,"href":"https:\/\/yamuparkoti.com\/ja\/wp-json\/wp\/v2\/posts\/5404\/revisions"}],"predecessor-version":[{"id":5466,"href":"https:\/\/yamuparkoti.com\/ja\/wp-json\/wp\/v2\/posts\/5404\/revisions\/5466"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/yamuparkoti.com\/ja\/wp-json\/wp\/v2\/media\/5403"}],"wp:attachment":[{"href":"https:\/\/yamuparkoti.com\/ja\/wp-json\/wp\/v2\/media?parent=5404"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/yamuparkoti.com\/ja\/wp-json\/wp\/v2\/categories?post=5404"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/yamuparkoti.com\/ja\/wp-json\/wp\/v2\/tags?post=5404"}],"curies":[{"name":"\u3046\u30fc\u3093","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}